Quick question on html tags.

fuzzy1

Hey All,

Debugging some phpmailer.class related code in a Sugar CRM based app, I come across some -- to me --
suspicious code in a suspect file: " $old = array('<','>'); $new = array('<','>'); ".

I have found on other occasions where this EXACT situation (html-'< or ,'> ) was cause for failure,
but I haven't found a good discussion on the matter. Could this be at the heart of my trouble here?

I've had occasion/need to employ htmlspecialchars(), but this doesn't seem like one of those cases.

Does php recognize < or ,'> the same as < or >?

///////////////////////////////////////////////////////////////////////////
////	REPLY PROCESSING
	$old = array('&lt;','&gt;');
	$new = array('<','>');
	if($_REQUEST['from_addr'] != $_REQUEST['from_addr_name'].' &lt;'.$_REQUEST['from_addr_email'].'&gt;') {
		if(false === strpos($_REQUEST['from_addr'], '&lt;')) { // we have an email only?
			$focus->from_addr = $_REQUEST['from_addr'];
			$focus->from_name = '';
		} else { // we have a compound string
			$newFromAddr =  str_replace($old, $new, $_REQUEST['from_addr']);
			$focus->from_addr = substr($newFromAddr, (1 + strpos($newFromAddr, '<')), (strpos($newFromAddr, '>') - strpos($newFromAddr, '<')) -1 );
			$focus->from_name = substr($newFromAddr, 0, (strpos($newFromAddr, '<') -1));
		}
	} elseif(!empty($_REQUEST['from_addr_email']) && isset($_REQUEST['from_addr_email'])) {
		$focus->from_addr = $_REQUEST['from_addr_email'];
		$focus->from_name = $_REQUEST['from_addr_name'];
	} else {
		$focus->from_addr = $focus->getSystemDefaultEmail();
	}

NogDog

There shouldn't be any "<" or ">" sequences in the form inputs unless the user is explicitly typing them in. The code looks rather suspect to me, too, though I suppose it could be a case of being taken out of context.